chore(ci): bump the actions-nonmajor group across 1 directory with 4 updates

[dependabot]

Bumps the actions-nonmajor group with 4 updates in the / directory: github/codeql-action/init, github/codeql-action/analyze, actions/deploy-pages and github/codeql-action/upload-sarif.

Updates github/codeql-action/init from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Benchmark delta (vs main)

Soft regression feedback only — this comment never blocks the PR.
Latency budget: ⚠️ when head > base × 1.3. Accuracy budget: ⚠️ when head < base - 1pp.

Routing summary (single backend × catalog sizes)

size	recall@k (head Δ vs base)	MRR (head Δ vs base)	p99 (ms)
50	✅ 0.5649 (+0.0000)	✅ 0.4978 (+0.0000)	✅ 0.345 (base 0.650)
83	✅ 0.3825 (+0.0000)	✅ 0.3242 (+0.0000)	✅ 0.528 (base 1.205)
1000	✅ 0.1475 (+0.0000)	✅ 0.1456 (+0.0000)	✅ 27.067 (base 47.855)

Per-backend × per-size matrix

backend	size	recall@k (Δ)	MRR (Δ)	p99 (ms)
bm25	100	✅ 0.3825 (+0.0000)	✅ 0.3399 (+0.0000)	✅ 4.683 (base 8.399)
bm25	500	✅ 0.2250 (+0.0000)	✅ 0.2165 (+0.0000)	✅ 23.671 (base 41.865)
bm25	1000	✅ 0.1575 (+0.0000)	✅ 0.1525 (+0.0000)	✅ 66.966 (base 112.387)
embedding_hashing	100	✅ 0.5175 (+0.0000)	✅ 0.4360 (+0.0000)	✅ 6.397 (base 7.218)
embedding_hashing	500	✅ 0.2700 (+0.0000)	✅ 0.2674 (+0.0000)	✅ 34.406 (base 43.171)
embedding_hashing	1000	✅ 0.2000 (+0.0000)	✅ 0.1931 (+0.0000)	✅ 74.271 (base 102.979)
embedding_st	100	skipped (skipped: missing sentence-transformers)	—	—
embedding_st	500	skipped (skipped: missing sentence-transformers)	—	—
embedding_st	1000	skipped (skipped: missing sentence-transformers)	—	—
fuzzy	100	skipped (skipped: missing rapidfuzz)	—	—
fuzzy	500	skipped (skipped: missing rapidfuzz)	—	—
fuzzy	1000	skipped (skipped: missing rapidfuzz)	—	—
tfidf	100	✅ 0.3825 (+0.0000)	✅ 0.3220 (+0.0000)	✅ 0.767 (base 1.193)
tfidf	500	✅ 0.2325 (+0.0000)	✅ 0.2314 (+0.0000)	✅ 7.330 (base 10.803)
tfidf	1000	✅ 0.1475 (+0.0000)	✅ 0.1456 (+0.0000)	✅ 27.676 (base 42.986)

Context pipeline (per scenario)

scenario	tokens	dropped	dedup
large_catalog	1480 (base 1480, Δ+0)	0 (base 0, Δ+0)	0 (base 0, Δ+0)
long_conversation	2500 (base 2500, Δ+0)	0 (base 0, Δ+0)	0 (base 0, Δ+0)
mixed_payload	488 (base 488, Δ+0)	0 (base 0, Δ+0)	0 (base 0, Δ+0)
short_conversation	487 (base 487, Δ+0)	0 (base 0, Δ+0)	0 (base 0, Δ+0)
stress_conversation	6590 (base 6590, Δ+0)	11 (base 11, Δ+0)	4 (base 4, Δ+0)
tiny_payload	256 (base 256, Δ+0)	0 (base 0, Δ+0)	0 (base 0, Δ+0)

---

Numbers come from make benchmark / make benchmark-matrix.
Latency is hardware-dependent — treat the markers as a rough guide.
See benchmarks/scorecard.md for the full picture.

[dgenio]

Review — actions-nonmajor group, 4 updates

Verdict: safe to merge. Three workflows, four action pins, no major crossing.

What the diff actually is

Judged from get_files rather than the title. The "4 updates" are four distinct Dependabot dependencies across three files, but only two upstream actions:

File	Action	Change
codeql.yml	github/codeql-action/init	db488dde… → cdf488f5… (# v4)
codeql.yml	github/codeql-action/analyze	db488dde… → cdf488f5… (# v4)
ossf-scorecard.yml	github/codeql-action/upload-sarif	db488dde… → cdf488f5… (# v4)
docs.yml	actions/deploy-pages	cd2ce8fc… → 368f8252… (# v5)

All SHA-pinned both sides, version comments retained, both within their major.

The check worth doing here: do the three codeql sub-actions move together?

codeql-action/init, /analyze and /upload-sarif are three Dependabot dependencies but one upstream action. If a group bump moved some and not others, the repository would run mismatched CodeQL components — init writing a database that a different analyze version reads. Worth confirming rather than assuming:

$ git grep -hn "github/codeql-action" origin/main -- .github/ | sed 's/^.*uses: //' | sort | uniq -c
      1 github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
      1 github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
      1 github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

All three sit on one SHA on main, and this PR moves all three to cdf488f5…. confirmed — the set stays consistent, before and after. Same grep for cd2ce8fc… (deploy-pages) returns the single site in docs.yml. No pin is left behind in either family.

Status

16/16 checks green. Note that CodeQL and Analyze (python) passing on this PR is not evidence the new CodeQL action works: a pull_request run uses the workflow definition from the base branch for some triggers, and more to the point the changed codeql.yml is exercised by its own schedule/push triggers. The real proof arrives on the first scheduled run after merge. Calling that out rather than citing the green as if it settled the question.

Not verified

I did not confirm cdf488f5… and 368f8252… are the genuine tag commits for their releases — github/codeql-action and actions/deploy-pages are outside this session's GitHub scope, so I cannot read their tags. unverified; the provenance rests on Dependabot, not on a check of mine.

Dependabot PR, so REVIEW only — not merging it.

---

Generated by Claude Code

[dgenio]

Review — approve with one caveat about what the green board actually proves

Verdict: safe to merge. All four bumps are patch-level, SHA-pinned, and their version comments are accurate. The one thing worth knowing is that CI only exercised half of them.

The bumps, verified against upstream tags

Checked with git ls-remote --tags rather than trusting the # v4 / # v5 comments:

Action	From	To
github/codeql-action/init	db488dd = v4.37.8	cdf488f = v4.37.9
github/codeql-action/analyze	db488dd = v4.37.8	cdf488f = v4.37.9
github/codeql-action/upload-sarif	db488dd = v4.37.8	cdf488f = v4.37.9
actions/deploy-pages	cd2ce8f = v5.0.0	368f825 = v5.0.1

Both comments are still truthful — v4.37.9 is v4, v5.0.1 is v5. No major crossing.

All three codeql-action references moved to the same sha. That is the thing most worth checking on a grouped action bump: three uses: lines across two files drawn from one repository, and a partial update would leave init and analyze on different builds of the same action. cdf488f in all three. Good.

The caveat — three of the four changed lines were never run

Analyze (python) and CodeQL are green, and those are real evidence for the init/analyze bump, because codeql.yml triggers on pull_request: branches: [main].

The other two changed workflows do not run on pull requests at all:

File	Trigger	Ran on this PR?
codeql.yml	push: [main], pull_request: [main], schedule	✅
docs.yml	push: [main], workflow_dispatch	❌
ossf-scorecard.yml	branch_protection_rule, push: [main]	❌

So the 16/16 board is evidence about codeql-action, and says nothing about deploy-pages@368f825 or about upload-sarif as invoked from the scorecard workflow. Those first execute after merge, on main — the Pages deploy and the scorecard SARIF upload respectively. For a patch bump of two well-known actions that is a small risk, but it is not zero, and the place it would surface is a broken docs deploy on main rather than a red PR.

docs.yml carries workflow_dispatch, so if you want that half covered before merging, dispatching it once on this branch is the cheap way.

Also worth noting

The board is from 2026-09-14. main has moved since — #889 landed 2026-09-19 — so this is a six-day-old green. Nothing in this diff interacts with that change, so I would not hold the PR for it; flagging it because a stale green is easy to read as a current one.

No blocking findings. Not merging it — Dependabot PRs get reviewed here, not merged.

---

Generated by Claude Code

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.